WhatsApp Setup — What We Need From You

• A chat bubble on the storefront where a customer leaves their number and a message.
• That message opens a real WhatsApp conversation with them.
• Your team reads and replies to those conversations from the WhatsApp Inbox in the admin panel.

This guide walks you through getting each one. It takes roughly 30–45 minutes, plus waiting time for two approvals from Meta.

At the very end there is a fill-in sheet. Complete it and send it back, and we'll do the rest.

---

Before you start

You will need:

1. A Facebook account (a personal one is fine — it's only used to log in).
2. A Meta Business account. If you don't have one, you'll be prompted to create one during Step 1 — it's free and takes a few minutes.
3. A phone number for the business that is not currently registered on WhatsApp or WhatsApp Business. ⚠️ Important: once this number is connected to the system, it can no longer be used in the normal WhatsApp app on a phone. Do not use your personal number. A new SIM or a landline that can receive a voice call works well.
4. Your business details (legal name, website, address) for verification.

---

Step 1 — Create the Meta app

1. Go to https://developers.facebook.com and log in with your Facebook account.
2. Top right → My Apps → Create App.
3. App name: Tesoro (or whatever you prefer — customers never see this).
4. When asked what you want the app to do, choose the option for Business / Messaging with WhatsApp.
5. Select or create your Business portfolio (your Meta Business account).
6. Click Create app and confirm your password.
7. On the next screen, find WhatsApp in the product list and click Set up.

You now have an app dashboard with WhatsApp in the left-hand menu.

---

Step 2 — Get values ① and ②

In the left menu, go to WhatsApp → API Setup (may be called "Quickstart" / "Getting started").

On this page you'll see a section titled Send and receive messages.

• ① Phone number ID — a long number shown under the "From" phone number. Click the copy icon. → This is value ① PHONE NUMBER ID.

• ② Temporary access token — at the top of the page there's a token box with a Copy button. It's a very long string of random characters. → This is value ② ACCESS TOKEN.

⚠️ This temporary token expires after 24 hours. That's fine for testing. In Step 7 you'll create a permanent one that replaces it — that's the one we actually use in production. If you'd rather not do a testing round, you can skip straight to Step 7 for this value.

---

Step 3 — Get value ③ (App Secret)

1. In the left menu, go to App settings → Basic.
2. Find the App secret field and click Show. Enter your Facebook password if asked.
3. Copy the value. → This is value ③ APP SECRET.

This is what proves that incoming messages genuinely come from WhatsApp and not from someone impersonating them. Treat it like a password.

---

Step 4 — Create the message template (values ④ and ⑤)

Why this is needed: WhatsApp does not allow a business to send a free-form message to someone who hasn't messaged them first. Since our chat widget lets a customer type a message on the website, the very first WhatsApp message technically comes from the business — so it must use a template that Meta has pre-approved.

1. Go to https://business.facebook.com/wa/manage/message-templates (or: WhatsApp Manager → Manage templates → Create template).

2. Fill in:

   • Category: Utility
   • Name: tesoro_website_enquiry (lowercase letters and underscores only — no spaces)
   • Language: English (US) — or your preferred language

3. Leave the Header empty.

4. In the Body, paste exactly this:

   Thanks for reaching out to Tesoro! You wrote: {{1}}
   
   One of our team will reply to you right here shortly.

   ⚠️ The {{1}} is essential and there must be exactly one of them. That placeholder is where the system inserts what the customer typed on the website. A template without it — or with two or more — will not work.

5. When Meta asks for a sample value for {{1}}, type something like: Do you have the Milano dining chair in stock?

6. Leave Footer and Buttons empty.

7. Click Submit.

Approval usually takes a few minutes, occasionally a few hours. You'll see the status turn to Active / Approved.

• → Value ④ TEMPLATE NAME is the exact name you chose, e.g. tesoro_website_enquiry.
• → Value ⑤ TEMPLATE LANGUAGE is the language code, e.g. en_US (shown next to the template in the list).

---

Step 5 — Invent value ⑥ (Verify Token)

This one you simply make up. It's a shared password between the website and Meta — nobody else ever sees it.

Make up a random string of ~20 characters, letters and numbers, e.g.:

tesoro7fK29xQm4Lp8Rt

→ This is value ⑥ VERIFY TOKEN. Write it down — you'll need to type the exact same string in Step 6.

---

Step 6 — Connect the webhook

This is what lets customer replies flow back into your admin inbox. Without it, you could send messages but never see the answers.

1. In the left menu, go to WhatsApp → Configuration.
2. Next to Webhook, click Edit.
3. Fill in:
   • Callback URL: https://YOUR-SITE-DOMAIN/api/whatsapp/webhook 👉 We will give you this exact URL — ask us for it before doing this step.
   • Verify token: the string you invented in Step 5, copied exactly.
4. Click Verify and save. If it succeeds, the fields save without an error. If you get an error, the most likely causes are a typo in the verify token, or that we haven't yet entered your values on the server — tell us and we'll sort it.
5. Back on the Configuration page, under Webhook fields, find the row named messages and click Subscribe.

⚠️ Step 6.5 is the one most people miss. If messages is not subscribed, replies from customers will never appear in the inbox.

---

Step 7 — Create a permanent access token (replaces value ②)

The token from Step 2 dies after 24 hours. For the live site you need one that doesn't expire.

1. Go to https://business.facebook.com/settings (Business settings).
2. Left menu → Users → System users.
3. Click Add, name it e.g. Tesoro Website, role Admin, and confirm.
4. With the new system user selected, click Assign assets.
   • Choose Apps → select your Tesoro app → enable Full control (Manage app) → Save.
   • Then Assign assets again → WhatsApp accounts → select your WhatsApp Business account → enable full control → Save.
5. Click Generate new token.
   • App: your Tesoro app
   • Token expiration: Never
   • Permissions: tick whatsapp_business_messaging and whatsapp_business_management
6. Click Generate token and copy it immediately — Meta will never show it again. If you lose it, just generate another one.

→ This replaces value ② ACCESS TOKEN.

---

Step 8 — Register your real business phone number

The test number Meta gives you in Step 2 can only message a handful of numbers you manually approve — it cannot message real customers. To go live you must add your own number.

1. Go to WhatsApp → API Setup → next to the phone number, click Add phone number.
2. Enter your business display name, category and description.
3. Enter the phone number from the Before you start checklist and verify it by SMS or voice call.
4. Once verified, that number appears in the "From" dropdown — its Phone number ID is now the real value ①. Copy it again and use that one.

You will also be asked to complete Business Verification (uploading a business registration document or utility bill) before you can message customers at volume. Meta reviews this — it can take anywhere from a day to about a week, so start it early.

---

Step 9 — Tell us the number to display

Separately from all of the above, the storefront shows a "Continue in WhatsApp" link. Tell us which number should appear there, in international format without the plus sign, e.g. 38269123456.

We'll set that in the admin panel.

Also confirm:

• Template status is Approved / Active
• Webhook shows as saved in WhatsApp → Configuration
• The messages webhook field is Subscribed
• Business Verification submitted (or already approved)

🔒 Please don't email these

Values ② and ③ are effectively passwords to your WhatsApp account. Please send them through a password manager share link (1Password, Bitwarden Send), or a service like https://onetimesecret.com which creates a link that self-destructs after being opened once. The rest of the values are not sensitive.

---

How we'll test it together

Once we've entered the values:

1. You open the Tesoro website and use the chat bubble — enter your own WhatsApp number and a message.
2. You should receive the template message on your phone within seconds.
3. Reply from your phone → it appears in the admin panel's WhatsApp Inbox.
4. We reply from the inbox → it lands back on your phone.

---

Two WhatsApp rules worth knowing

The 24-hour window. Once a customer messages you, you can reply freely for 24 hours. After 24 hours of silence, WhatsApp blocks free-form replies — the conversation has to be restarted with an approved template, or by the customer messaging again. This is Meta's rule, not a limitation of your website. The admin inbox will tell you when a conversation has gone outside the window.

Cost. WhatsApp Business conversations are priced per conversation by Meta, and rates vary by country. There's a monthly free allowance. You'll add a payment method in Business settings → WhatsApp Accounts → Payment settings. This is billed by Meta directly to you, not through us.